A company has an internal website behind an internal ALB in a VPC with CIDR 172.31.0.0/16. A Route 53 private hosted zone for example.com exists in that VPC. The company uses a Site-to-Site VPN between its office network and the VPC. Employees must access the internal site from the office using https://example.com. Which combination of steps will enable this? (Choose two.)

To resolve example.com to the internal ALB, an alias record pointing to the ALB must be created in the Route 53 private hosted zone. Alias records are preferred over CNAMEs for AWS resources like ALBs because they can be created at the zone apex (e.g., example.com) and automatically track IP address changes of the target. For the office network to resolve example.com using the private hosted zone, DNS queries for this domain must be forwarded to AWS. A Route 53 Resolver inbound endpoint allows on-premises DNS servers to query Route 53 private hosted zones. Configuring a conditional forwarder on the office DNS server to send example.com queries to this inbound endpoint enables resolution. An outbound endpoint is used for VPCs to query on-premises DNS. Forwarding to 172.31.0.2 (VPC DNS resolver) directly from on-premises is not supported over VPN; a Resolver endpoint is required.